One of crypto's most fundamental guarantees, that only 100 billion XRP will ever exist, turns out to have had a hidden crack in it for ten years. Developers have quietly patched a bug in the XRP Ledger that could have let an attacker create roughly 18 trillion XRP out of thin air in a single transaction, an amount 184 times larger than the token's entire supply. The flaw was never exploited, and it's now fixed. But the story of how it hid for a decade, and how an AI finally caught it, is a striking look at crypto's evolving security frontier.
What the bug could have done
The vulnerability was an "overflow" bug in the XRP Ledger's payment engine, the core code that processes transactions. According to Veria Labs, the security firm that found it, an attacker could have crafted a specific sequence, setting up a large number of tiny balances a normal trader would use, then building a single payment designed to consume them all at once in a way the code mishandled.
The result would have been catastrophic for XRP's economics: by Veria Labs' count, just one exploit transaction could have created about 18 trillion spendable XRP. To put that in perspective, XRP's total supply was capped at 100 billion at launch and actually shrinks slightly over time as transaction fees are burned. Minting 18 trillion would have been 184 times the entire supply, instantly and permanently shattering the scarcity that underpins the token's value. An attacker could have spent that fabricated XRP before the network realized what had happened.
Why it stayed hidden for a decade
Here's the unsettling part: the flawed code dates back to 2015, meaning it sat in one of crypto's most-used, most-scrutinized ledgers for roughly ten years without being caught. This is a recurring theme in crypto security in 2026: some of the most dangerous vulnerabilities aren't in flashy new code, but buried in old, foundational, "battle-tested" software that everyone assumed was safe precisely because it had been there so long and never caused a problem.
The reassuring news: developers said they found no sign the bug was ever exploited. The scarcity guarantee held in practice, even though it was theoretically breakable. No XRP was ever illegitimately created, and holders' funds were never actually drained.
The twist: an AI found it
Perhaps the most significant detail is who, or what, caught the bug. Veria Labs co-founder Cayden Liao said the firm's AI agent discovered the flaw and even built a working exploit to prove it was real. For finding and responsibly disclosing it, Veria Labs received the XRP bug-bounty program's maximum payout of $250,000.
This matters beyond XRP. It's a concrete example of AI being used defensively, an automated agent combing through a decade of code and spotting a flaw that human auditors had missed for ten years. It mirrors a broader trend in 2026, where AI is being deployed both to attack crypto (probing for weaknesses at machine speed) and to defend it (auditing codebases faster and more thoroughly than humans can). In this case, the defenders got there first, which is exactly how responsible security is supposed to work.
How it was handled
RippleX, the development arm behind the XRP Ledger, patched the bug on September 25, and notably did so without waiting for a full validator vote, a sign of how seriously the team treated the severity. The fix is already live on the network. The disclosure was made public only after the patch was in place, following the standard responsible-disclosure practice of fixing first, announcing second, so attackers couldn't race to exploit a known, unpatched flaw.
